bug: Duplicate ErrMissingKernelArgumentCex error when boot_device and storage.luks both configure CEX root

Created originally in Butane by @deepak0x: https://github.com/coreos/butane/issues/731

---

name

Duplicate ErrMissingKernelArgumentCex error when boot_device and storage.luks both configure CEX root

about

Bug report: Config.Validate in config/openshift/v4_23_exp/validate.go emits ErrMissingKernelArgumentCex twice at the same path when boot_device.luks.cex.enabled and a storage.luks root entry with cex.enabled are both set.

title

Duplicate ErrMissingKernelArgumentCex error when boot_device and storage.luks both configure CEX root

labels

kind/bug

warning

No response

---

Description

Config.Validate in config/openshift/v4_23_exp/validate.go#L53 contains two independent if-blocks. Each calls r.AddOnError(c.Append("openshift", "kernel_arguments"), common.ErrMissingKernelArgumentCex) when the kernel argument rd.luks.key=/etc/luks/cex.key is absent. When a config sets both boot_device.luks.cex.enabled: true and a storage.luks entry with name: root and cex.enabled: true, both blocks fire and the identical error is reported twice at $.openshift.kernel_arguments.

Block 1 (line 54): fires when util.IsTrue(conf.BootDevice.Luks.Cex.Enabled) is true and the kernel argument is absent.

Block 2 (lines 57–65): iterates conf.Storage.Luks, sets cex = true when any entry has name == "root" and util.IsTrue(l.Cex.Enabled), then fires when cex is true and the kernel argument is absent.

The two blocks share no state and have no deduplication logic. Both can fire in the same Validate call.

Affected code

func (conf Config) Validate(c path.ContextPath) (r report.Report) {
    if util.IsTrue(conf.BootDevice.Luks.Cex.Enabled) && !slices.Contains(conf.OpenShift.KernelArguments, "rd.luks.key=/etc/luks/cex.key") {
        r.AddOnError(c.Append("openshift", "kernel_arguments"), common.ErrMissingKernelArgumentCex)
    }
    cex := false
    for _, l := range conf.Storage.Luks {
        if util.IsTrue(l.Cex.Enabled) && l.Name == "root" {
            cex = true
        }
    }
    if cex && !slices.Contains(conf.OpenShift.KernelArguments, "rd.luks.key=/etc/luks/cex.key") {
        r.AddOnError(c.Append("openshift", "kernel_arguments"), common.ErrMissingKernelArgumentCex)
    }

    return
}

Permalink: https://github.com/coreos/butane/blob/cb34e120e5267bfd5bdfa83fa8c2e44e06dedda2/config/openshift/v4_23_exp/validate.go#L53

What the user sees

The message 'rd.luks.key=/etc/luks/cex.key' must be set as kernel argument when CEX is enabled for the boot device appears twice at $.openshift.kernel_arguments for a single config that has one missing kernel argument.

Reproduction

Save the following as cex-both.bu:

variant: openshift
version: 4.23.0-experimental
metadata:
  name: test
  labels:
    machineconfiguration.openshift.io/role: worker
boot_device:
  layout: s390x-eckd
  luks:
    cex:
      enabled: true
    device: /dev/dasda
storage:
  luks:
    - name: root
      device: /dev/dasda
      cex:
        enabled: true
openshift:
  kernel_arguments: []

cat cex-both.bu | ./bin/amd64/butane --raw 2>&1

Expected: One validation error for the missing rd.luks.key=/etc/luks/cex.key kernel argument.

Actual: The identical error block for ErrMissingKernelArgumentCex appears twice in the output.

Affected versions

The same two-block pattern likely exists in the corresponding validate.go files for v4_19, v4_20, v4_21, and v4_22.

Are you working on this issue?

Yes

Start with config/openshift/v4_23_exp/validate.go and compare the corresponding validate.go files for v4_19 through v4_22. Reproduce the issue with cex-both.bu using ./bin/amd64/butane, then verify that the configuration reports one missing-kernel-argument error instead of two.